EP1746764A2 - System, Vorrichtung und Verfahren zur vereinheitlichten Netzsicherheitsverwaltung - Google Patents

System, Vorrichtung und Verfahren zur vereinheitlichten Netzsicherheitsverwaltung Download PDF

Info

Publication number
EP1746764A2
EP1746764A2 EP06015237A EP06015237A EP1746764A2 EP 1746764 A2 EP1746764 A2 EP 1746764A2 EP 06015237 A EP06015237 A EP 06015237A EP 06015237 A EP06015237 A EP 06015237A EP 1746764 A2 EP1746764 A2 EP 1746764A2
Authority
EP
European Patent Office
Prior art keywords
security management
user
security
function entity
smc
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
EP06015237A
Other languages
English (en)
French (fr)
Other versions
EP1746764A3 (de
Inventor
518129 Huawei Administration Bld. Yang Bo
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Publication of EP1746764A2 publication Critical patent/EP1746764A2/de
Publication of EP1746764A3 publication Critical patent/EP1746764A3/de
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/28—Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general

Definitions

  • the present invention relates to network management technologies for communication systems, and particularly to security management system, device and method for network management of communication devices.
  • the Network Management System is generally responsible for monitoring, configuring and fault diagnosing of network devices.
  • the main functions of a Network Management System include automatic topology discovery, remote configuration, performance parameter monitoring, and fault diagnosis.
  • Various Network Management Systems are mainly developed by two kinds of enterprises; one is the universal network management software providers, and the other is the respective network device providers who provide network management solutions with respect to their own products.
  • a specific Network Management System designed by a device manufacturer for its own products has very comprehensive functions of monitoring and configuration for its own products, which is capable of monitoring some important performance specifications that can't be monitored by the universal Network Management System, and also has some particular configuration functions. But such a specific Network Management System is helpless to other manufacturers' network devices.
  • Security management is an important part of network management, which mainly implements management of account information and rights of network administrators, guaranteeing secure accesses and operations to the network devices by the legal network management users, and preventing operations without authorization.
  • Security management includes functions, such as authorization, user verification, access control and security logging, etc.
  • a reliable security management mechanism has a vital effect on the whole Network Management System, and even on the security and reliability of the whole network.
  • the present invention provides a universal security management system for network management, device and method, which implements a centralized, universal security management for network management in a communication network which includes network devices provided by various manufacturers.
  • a universal security management system for network management comprising a Security Management Center (SMC), at least one Function Entity (FE) and at least one Security Management Gateway (SMG); wherein the whole network is divided into at least one Security Domain (S-Domain), each Security Domain comprising at least one said Function Entity; and each said Security Domain corresponds to at least one said Security Management Gateway which is adapted to adapt a Security Management Interface (SMI) of the at least one Function Entity in the Security Domain to a Universal Security Management Interface (USMI) provided by the Security Management Center.
  • SMC Security Management Center
  • FE Function Entity
  • SMG Security Management Gateway
  • the universal security management system for network management further comprises a Security Management User Interface (SMUI) which is adapted to provide a user interface of security management to the administrator based on the Security Management Center.
  • SMUI Security Management User Interface
  • the Security Management Center is adapted to manage user information, authorization information and identity verification information of the whole network, to interact with the Function Entities in the whole network through the Security Management Gateways of the Security Domains, and to interact with the administrator through the Security Management User Interface.
  • the Function Entity is adapted to forward user verification requests to the Security Management Gateway of the Security Domain the Function Entity pertains to, to download the right information of the user currently logging in from the Security Management Center through the Security Management Gateway and buffer the right information, to authenticate a user operation according to the right information, and to clear the buffer of the right information at the time of the user's logout or according to pre-configured policies.
  • the Security Management Gateway interacts with all the Function Entities in the Security Domain the Security Management Gateway pertains to through the Security Management Interface of the Security Domain, and interacts with the Security Management Center through the Universal Security Management Interface, for forwarding the user verification requests sent by the Function Entities to the Security Management Center, and forwarding the right information sent by the Security Management Center to the Function Entities.
  • a universal security management system for network management comprising a Security Management Center (SMC), at least one Function Entity (FE) and at least one Security Management Gateway (SMG); wherein said at least one Function Entity is adapted to process user services; said Security Management Center is adapted to implement the security management of the whole network; and said at least one Security Management Gateway each corresponds to at least one Function Entity, which is adapted to implement a data interaction between the Security Management Center and the at least one Function Entity the Security Management Gateway corresponds to.
  • SMC Security Management Center
  • FE Function Entity
  • SMG Security Management Gateway
  • the Security Management Gateway interacts with the corresponding Function Entity through a Security Management Interface (SMI) of the Function Entity, and interacts with the Security Management Center through a Universal Security Management Interface (USMI) provided by the Security Management Center.
  • SMI Security Management Interface
  • USMI Universal Security Management Interface
  • a Security Management Gateway for network management, which corresponds to at least one Function Entity (FE), and implements an interaction between the Function Entity and a Security Management Center (SMC) of a Network Management System (Network Management System), comprising:
  • the Function Entity interaction unit interacts with the corresponding Function Entity through the Security Management Interface of the Function Entity; the Security Management Center interaction unit interacts with the Security Management Center through a Universal Security Management Interface provided by the Security Management Center.
  • a Security Management Center comprising a Universal Security Management Interface (USMI), wherein the Security Management Center further comprises:
  • FE Function Entity
  • SMI Security Management Interface
  • a method for user management of a universal security management system for network management comprising the following steps of receiving, through a Security Management User Interface (SMUI), a user management operation request from an administrator, and sending the user management operation request to a Security Management Center (SMC); processing, at the Security Management Center, the user management operation request, and returning a processing result to the Security Management User Interface; and displaying the processing result, by the Security Management User Interface, on a user interface.
  • SMUI Security Management User Interface
  • SMC Security Management Center
  • a method for user authorization of a universal security management system for network management comprising the following steps of receiving, through a Security Management User Interface (SMUI), a user authorization operation request from an administrator, and sending the user authorization operation request to a Security Management Center (SMC); obtaining, by the Security Management Center, the information of authorizable operating type and authorizable operating object from a Security Management Gateway (SMG), and returning the information of authorizable operating type and authorizable operating object to the Security Management User Interface; displaying, by the Security Management User Interface, the information of authorizable operating type and authorizable operating object on an administrator interface for the administrator's reference when the administrator performs an authorization operation; sending, through the Security Management User Interface, the user authorization operation request to the Security Management Center after the authorization operation is accomplished by the administrator; processing, at the Security Management Center, the authorization operation, saving the user authorization information, and returning a processing result to the Security Management User Interface; and displaying, by the Security Management User Interface, the processing result on
  • SMUI Security Management User Interface
  • a method for user authorization of a universal security management system for network management comprising the following steps of obtaining, by a Security Management Center (SMC), information of authorizable operating type and authorizable operating object from a Security Management Gateway (SMG) each time the Security Management Center starts up, and saving the information by the Security Management Center in local; initiating, by the Security Management Gateway, a synchronizing procedure with the Security Management Center after each time of the update and the modification of the Security Management Gateway, so as to maintain the synchronization of the information of authorizable operating type and authorizable operating object between the Security Management Gateway and the Security Management Center; performing, by the administrator, an authorization operation according to the information of authorizable operating type and authorizable operating object provided by the Security Management Center; sending, through a Security Management User Interface (SMUI), an authorization operation request to the Security Management Center after the authorization operation; processing, at the Security Management Center, the authorization operation, saving the user authorization information, and returning a processing result to the Security Management
  • SMC Security Management Center
  • SMG Security Management
  • a method for user verification of a universal security management system for network management comprising the following steps of receiving, by a Function Entity (FE), a user verification request, and sending the user verification request to a Security Management Gateway (SMG) of the Security Domain (S-Domain) that the Function Entity pertains to, and forwarding, by the Security Management Gateway, the user verification request to a Security Management Center (SMC); processing, at the Security Management Center, the user verification request and then returning a verification result and user right information to the Security Management Gateway, and forwarding, by the Security Management Gateway, the verification result and the user right information to the Function Entity; and buffering, by the Function Entity, the user right information in local until the user logs out or a time limit expires.
  • FE Function Entity
  • SMG Security Management Gateway
  • S-Domain Security Domain
  • SMC Security Management Center
  • the step of receiving by the Function Entity the user verification request further comprises determining, by the Function Entity, whether to forward the user verification request or not according to pre-configured local policies; if it is yes, forwarding the user verification request to the Security Management Gateway, otherwise directly processing the user verification request in local; before the step of buffering by the Function Entity the user right information in local.
  • the method further comprises determining, by the Function Entity, whether to buffer the user right information or not according to the pre-configured local policies.
  • a method for user authentication of a universal security management system for network management comprising the following steps of authenticating, by a Function Entity (FE), a user operation according to user right information buffered in local, and executing the user operation, by the Function Entity, after passing the authentication; and clearing, by the Function Entity, the locally buffered user right information according to pre-configured policies when the user logs out or a time limit expires.
  • FE Function Entity
  • the technical solution of the present invention differs from the prior art mainly in that the network devices, that is, function entities, provided by different device manufacturers, are divided into different security domains; in each security domain there is arranged at least one security management gateway which is adapted to adapt a security management interface in the security domain to a universal security management interface; through which universal security management interface the centralized security management for the function entities in the whole network by a security management center can be achieved; moreover, there is provided a security management user interface to the security administrator; the security management system of the present invention runs through four work flows, i.e., user management, user authorization, user verification, and user authentication; the interaction between different function entities and the security management center is implemented through the security management gateway; and the forwarding of the user verification request, the downloading and buffering of the user right information is implemented by improving the function entity.
  • the network devices that is, function entities, provided by different device manufacturers, are divided into different security domains; in each security domain there is arranged at least one security management gateway which is adapted to adapt a security management interface
  • the difference between the technical solutions brings comparatively obvious beneficial effect, that is, the provision of the security management center and the universal security management interface implements the basis of the centralized security management, and the division of the security domains and the adaptation of the security management gateway implements the universal management for the different function entity in the whole network; therefore, a centralized user management, right management and user verification mechanisms can be achieved by using a uniform approach, without large-scale modifications to the existing devices, thus simplifying the network management, avoiding the confusion due to the variance of multiple security management interface, and improving the security and reliability of the network.
  • the main idea of the present invention is: to divide the network devices, i.e., function entities, within the whole network into different security domains, each of which includes multiple function entities and at least one security management gateway, according to the manufacturers of the network devices or to the security management interfaces supported by the network devices; the security management gateway is adapted to adapt security management interfaces of the function entities in the security domains to a normal interface provided by a security management center; the so-called security management center is the part implementing centralized user management, right management and identity verification, which also provides a user interface to a system administrator through a security management user interface.
  • the system administrator that is, the administrator, is the person who is responsible for the management of the rights of the operators or of the network management users in the whole network, and the network management users, i.e., the users, are the operators who implement network management of the whole network through operations on the function entities.
  • the administrator implements management of the users and their right information at the security management center through the security management user interface, and the security management center implements interaction with different function entities through the respective security management gateways of the security domains.
  • the running of the security management system for network management comprises four flows as follows: user management, that is, the administrator managing the user information by directly operating a user database at the security management center; user authorization, that is, the administrator authorizing a user at the security management center, wherein the authorizing comprising that the security management center inquiring the security management gateways about the information of authorizable operations and providing the information to the administrator as a reference; user verification, that is, when a user logs in a function entity prior to his performing of a network management operation, the function entity sending a verification request to the security management center, and the security management center authenticating the user and returning a verification result, and if the verification is successful, the verification result returned by the security management center containing the user right information at the same time and the function entity buffering the user right information; user authentication, that is, the function entity authenticating each operation of the user according to the local buffered right information of the user, and making a decision.
  • the main structure of the security management system includes Security Management Center (SMC) 110, Security Management User Interface (SMUI) 120, Function Entities (FE) 130 made by multiple different manufacturers and Security Management Gateways (SMG) 140 adapted for adaptation.
  • SMC Security Management Center
  • SMUI Security Management User Interface
  • FE Function Entities
  • SMG Security Management Gateways
  • the Function Entities 130 in the whole network are divided into different Security Domains (S-Domains) 200 according to their manufacturers.
  • Each of Security Domains 200 includes a corresponding Security Management Gateway 140, which is adapted to adapt the Security Management Interface (SMI) 210 of the Function Entities in the Security Domain to a Universal Security Management Interface (USMI) 150 provided by the Security Management Center 110.
  • SMI Security Management Interface
  • USMI Universal Security Management Interface
  • Security Domain is a concept of dividing the carrier's whole network as viewed from security management.
  • One Security Domain includes devices provided by a certain device manufacturer. The Security Domain interacts with the external completely through the Security Management Gateway 140.
  • the Function Entity 130 here generally refers to a physical or logical entity providing some network services in the network. These Function Entities 130 are all under the management of the Network Management System, receiving operations from users to implement network management. Before accessing any Function Entity 130, a user needs to be subjected to user identity verification; and after passing the user identity verification, the user needs to be subjected to an access authentication in conjunction with the user identity in each access.
  • Security Management Center 110 is adapted to implement the user management, the right management and the identity verification of the whole network, which is a module that manages the users in the whole network centrally.
  • Security Management User Interface 120 provides a user interface such as Graphic User Interface (GUI), Command Line Interface (CLI), and WEB Portal, etc. to the administrator based on the Security Management Center.
  • GUI Graphic User Interface
  • CLI Command Line Interface
  • WEB Portal etc.
  • Fig.1 From Fig.1, it can be seen that the whole network is divided into multiple Security Domains 200, each of which generally includes the Function Entities 130 only provided by the same manufacturer.
  • a Security Management Gateway 140 which is mainly responsible for adapting the manufacturer-specific Security Management Interface 210 to the Universal Security Management Interface 150 provided by the carrier's centralized Security Management Center.
  • the Security Management Gateway 140 is an adaptation module for each Security Domain 200 with the Security Management Center 110; and the Function Entities 130 in the Security Domains need to forward user identity verification requests and to download user right information through the Security Management Gateway 140.
  • a uniform Security Management Center 110 is arranged in the whole network domain, which provides the Universal Security Management Interface 150 to implement centralized user management, right management and identity verification of the whole network, and interacts with the Security Management Gateway 140 of each Security Domain 200 to process the identity verification requests forwarded by the Security Management Gateway 140 and to send the user right information downward. At the same time, the Security Management Center 110 also receives the administrator's management operation on the user data through the Security Management User Interface 120.
  • the Function Entity 130 first receives the user operation, forwarding the user verification request to the Security Management Gateway 140 of the Security Domain that the Function Entity 130 pertains to when the user logs in, and then the user verification request will be sent upward to the Security Management Center 110 by the Security Management Gateway 140; at the same time, the Function Entity 130 also downloads the right information of the user presently logging from the Security Management Center 110 through the Security Management Gateway 140 and buffering the right information at the local; in this way, the Function Entity 130 can authenticate the user operation according to the buffered right information each time the user operates, and clear the buffer of the right information according to a pre-configured policy each time the user logs out or the valid time limit expires, which can ensure the user right information is again downloaded and updated from the Security Management Center 110 when the user logs in next time.
  • the main function of the Security Management Gateway 140 is to adapt the specific Security Management Interface 210 inside the Security Domain to the Universal Security Management Interface 150 outside the Security Domain.
  • the Security Management Gateway 140 interacts with all the Function Entities 130 through the specific Security Management Interface 210 within the Security Domain that the Security Management Gateway 140 pertains to, and interacts with the Security Management Center 110 through the Universal Security Management Interface 150 outside said Security Domain. in this way, the Security Management Gateway 140 can forward the requests sent upward by the Function Entities 130 which include the user verification requests sent by the Function Entities 130 to the Security Management Center 110, and also forward the user information sent downward by the Security Management Center 110 which include the user right information sent by the Security Management Center 110 to the Function Entities 130.
  • the Security Management Gateway 140 is a key component for implementing the universal security management.
  • the Security Management Center 110 is the carrier of the uniform centralized management of the whole network, adapted to manage the user information, the authorization information and the identity verification information of the whole network.
  • the Security Management Center 110 interacts with Function Entities 130 within the whole network through the respective Security Management Gateways 140 of the Security Domains, and on the other side the Security Management Center 110 interacts with the administrator through the Security Management User Interface 120.
  • the four basic work flows include user management, user authorization, user verification and user authentication, wherein the user management and the user authorization are top-down management operations to the users on the administrator side, and the user verification and the user authentication are bottom-up request procedures of requesting verification and authentication on the user side when the users log in.
  • User management refers to the operations performed by the administrator directly on the user database at the Security Management Center, including the operations, such as Add User, Delete User, Modify user information, etc.
  • the modules and the work flow involved in these user management operations are shown as Fig.2.
  • the operation request initiated by the administrator is received at the user interface of the Security Management User Interface, and then forwarded to the Security Management Center; the Security Management Center processes the request, that is, it performs the user management operation, and returns the processing result to the Security Management User Interface; finally, the Security Management User Interface displays the processing result on the user interface.
  • User authorization refers to the operations, such as adding rights for user, and modifying user rights by the administrator.
  • the rights of a user define the types and the objects of the operations performed by the user on the Function Entities. For example, access right of a user for files on Function Entities should be described as: what operating rights on which files the user possesses, such as Add, Delete, and Modify, etc. Therefore, users' right information should include at least two parts information, i.e., "operating type” and "operating object".
  • the user authorization is similar with the user management; they both send operation requests downward through the Security Management User Interface, and after the processing by the Security Management Center, receive operation results.
  • the user authorization has one more flow compared with the user management, that is, the Security Management Center needs to inquire the Security Management Gateway about the information of the authorizable operating types and operating objects, and presents the information on the authorization user interface for the administrator's reference, such that the administrator can implement the user authorization. It is surly possible that the Security Management Gateway need to further inquire the Function Entity about the information of the "operating type" and the "operating object", which is omitted in the description of the embodiment of the present invention.
  • the modules and the work flow involved in these user authorization operations are shown as Fig.3.
  • the administrator operates on the user interface, and the user authorization operation request of the administrator is received at the Security Management User Interface and then sent to the Security Management Center through the Security Management User Interface; then, the Security Management Center obtains information of authorizable operating types and operating objects from the Security Management Gateway, and returns the information to the Security Management User Interface; then, the information of the authorizable operation type and operating object is displayed on the administrator interface through the Security Management User Interface for the administrator's reference.
  • the first half flow is completed, and now the administrator can choose how to authorize the user according to the selecting of the provided authorizable information; and after the authorization operation, the authorization operation request is sent to the Security Management Center through the Security Management User Interface in return; then, the Security Management Center processes the authorization operation, saves the user authorization information, and returns the processing result to the Security Management User Interface; finally, the processing result is displayed on the administrator's interface through the Security Management User Interface.
  • the Security Management Center needs to inquire the Security Management Gateways each time of the user authorization, which, in another embodiment of the present invention, is simplified by saving the authorizable information at the Security Management Center and setting up a synchronization mechanism with the Security Management Gateway.
  • the Security Management Center obtains the information of authorizable operating type and operating object from the Security Management Gateway and saves the information in local each time of initiating; and after that, the Security Management Gateway initiates a synchronization procedure to the Security Management Center after each time of updating and modifying the information, so as to maintain the synchronization of the information of the authorizable operating type and operating object between the Security Management Gateway and the Security Management Center.
  • the inconvenience of inquireing the Security Management Center each time of authorization operation is avoided, saving the operating time.
  • User verification and user authorization refer to the operation procedure that after a user logs in a certain Function Entity when performing network management operation, the Function Entity needs to obtain the user information for authenticating from the uniform user database of whole network, i.e. from the Security Management Center; and after that, the Function Entity makes an authentication decision according to the user information each time the user operates.
  • an apparent mechanism is that the Function Entities in the whole network all authenticate the users through the Security Management Center and download the user right information from the Security Management Center, and the interaction between the Function Entities and the Security Management Center in this mechanism is adapted through the Security Management Gateway.
  • the Function Entities also need to buffer the user information, which not only speeds up the authentication, but also ensures the timely update of the user right information; therefore, the Function Entities need to ensure that the user information is downloaded renewedly at the time of log in and cleared at the time of log out.
  • Fig.4 and Fig.5 respectively illustrate the work flows of the user verification and the user authentication according to the embodiments of the present invention.
  • the user logs in an Function Entity, at which time the user provides identity identifiers such as user name and verification information such as password, digit Certificate so as to verify its identity; the Function Entity receives the user verification request and forwards the request to the Security Management Gateway in the Security Domain the Function Entity pertains to; the Security Management Gateway forwards the user verification request to the Security Management Center; then, the Security Management Center processes, the user verification request, that is, to perform the user verification, and return the user right information to the Security Management Gateway, which further forwards the information to the Function Entity; after that, the Function Entity obtains the user verification result and the user right information, and buffers the user right information in local until the user logs out or the time limit expires.
  • identity identifiers such as user name and verification information such as password, digit Certificate so as to verify its identity
  • the Function Entity receives the user verification request and forwards the request to the Security Management Gateway in the Security Domain the Function Entity pertains to; the Security Management Gateway forwards the user verification request to the Security Management Center
  • the Function Entity can forward the verification request according to the local configured policy, and save the user right information returned from the Security Management Gateway. Only when the Function Entity implements the forwarding of the verification request and the buffering of the user right information returned from the Security Management Gateway, the centralized security management mechanism can be implemented.
  • the Function Entity clears its saved user right information, and downloads the user right information renewedly at the time of next login, so as to keep the user right updated timely.
  • the user authentication refers to that the Function Entity authenticates the user operation according to the locally buffered user right information, to determine whether to allow the user to perform the operation.
  • the content of the authentication includes "operating type” and "operating object", and only when the user has both the rights, he is considered to have the right for the operation.
  • the Function Entity authenticates the user operation according to the locally buffered user right information, and executes the operation after the user passes the authentication; and clears the locally buffered user right information according to the pre-configured policy.
  • the four work flows are implemented by means of the function systems of the components and the cooperation thereof, which not only provides the information management of the users in the whole network by the administrator, but also provides the necessary verification and authentication mechanism when the user operates the Function Entities in the whole network.
  • each Security Domain can have multiple Security Management Gateways.
  • each logic entity can be implemented in a single physical device, or multiple logical entities can be implemented in the same physical device.
  • the carrier can implement centralized user management, right management and user verification mechanisms using a uniform approach according to the embodiments of the present invention, without large-scale modifications to the existing devices, thus simplifying the network management, avoiding the confusion due to the variance of multiple system right information, and improving the security and reliability of the network.
  • the Security Management Gateway of an embodiment of the present invention corresponds to at least one Function Entity, and implements the interaction between said Function Entity and the Security Management Center of Network Management System.
  • the Security Management Gateway includes:
  • Function Entity interaction unit 610 interacts with the corresponding Function Entities through the Security Management Interface (not shown in the figure) of the Function Entities;
  • Security Management Center interaction unit 630 interacts with the Security Management Center through the Universal Security Management Interface (not shown in the figure) provided by the Security Management Center.
  • the processing unit 630 includes:
  • the Security Management Gateway can be arranged at the Security Management Center, or inside each of the Function Entities.
  • the Security Management Center When the Security Management Gateway is arranged at the Security Management Center, the Security Management Center according an embodiment of the present invention includes: the Universal Security Management Interface 720, the Function Entity interaction unit 710 adapted to implement data interaction with the Function Entities, and the adaptation unit 730 adapted to implement the adaptation of the data transmitted between the Universal Security Management Interface and the Function Entity interaction unit, as shown in Fig.7.
  • the Function Entity When the Security Management Gateway is arranged at the Function Entity, the Function Entity according to an embodiment of the present invention includes: the Security Management Interface 810, the Security Management Center interaction unit 820 adapted to implement the data interaction with the Security Management Center, and the adaptation unit 830 adapted to implement the adaptation of the data transmitted between the Security Management Interface and the Security Management Center, as shown in Fig.8.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
EP06015237A 2005-07-21 2006-07-21 System, Vorrichtung und Verfahren zur vereinheitlichten Netzsicherheitsverwaltung Ceased EP1746764A3 (de)

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CNB2005100361231A CN100461690C (zh) 2005-07-21 2005-07-21 通用网管安全管理系统及其方法

Publications (2)

Publication Number Publication Date
EP1746764A2 true EP1746764A2 (de) 2007-01-24
EP1746764A3 EP1746764A3 (de) 2007-02-07

Family

ID=37103148

Family Applications (1)

Application Number Title Priority Date Filing Date
EP06015237A Ceased EP1746764A3 (de) 2005-07-21 2006-07-21 System, Vorrichtung und Verfahren zur vereinheitlichten Netzsicherheitsverwaltung

Country Status (4)

Country Link
US (1) US20070022470A1 (de)
EP (1) EP1746764A3 (de)
CN (2) CN100461690C (de)
WO (1) WO2007009350A1 (de)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101442425B (zh) * 2007-11-22 2012-03-21 华为技术有限公司 网关的管理方法及装置、系统
CN102932184A (zh) * 2012-11-06 2013-02-13 华为技术有限公司 一种网络管理的方法、装置及系统
CN103634138A (zh) * 2012-08-27 2014-03-12 阿里巴巴集团控股有限公司 分布式调度的远程管理与运维方法及其系统
WO2014100781A1 (en) 2012-12-23 2014-06-26 Mcafee, Inc. Trusted container
US9088543B2 (en) 2013-06-03 2015-07-21 International Business Machines Corporation Coordinated network security management

Families Citing this family (23)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9654200B2 (en) 2005-07-18 2017-05-16 Mutualink, Inc. System and method for dynamic wireless aerial mesh network
CN101197711B (zh) * 2007-12-06 2012-04-04 华为技术有限公司 一种实现统一鉴权管理的方法、装置及系统
CN101599831B (zh) * 2008-06-06 2011-09-21 中兴通讯股份有限公司 一种通信网络安全管理方法及系统
US8850561B2 (en) * 2008-08-25 2014-09-30 International Business Machines Corporation Associating operating system native authorizations with console roles
PL2392099T3 (pl) * 2009-02-02 2018-02-28 Nokia Solutions And Networks Oy Komunikowanie zdarzenia w sieci
US8504837B2 (en) 2010-10-15 2013-08-06 Rockwell Automation Technologies, Inc. Security model for industrial devices
CN102455894A (zh) * 2010-10-26 2012-05-16 镇江精英软件科技有限公司 一种快速构建信息系统软件的构架
CN102457560B (zh) * 2010-10-29 2016-03-30 中兴通讯股份有限公司 一种云计算的安全管理方法和系统
CN102025725B (zh) * 2010-11-22 2016-12-07 北京百卓网络技术有限公司 电信业务环境安全系统及其实现方法
CN102158529A (zh) * 2011-01-27 2011-08-17 浪潮电子信息产业股份有限公司 基于php环境实现网络存储高效管理的方法
CN102104607B (zh) * 2011-03-10 2013-11-06 易程（苏州）软件股份有限公司 访问业务的安全控制方法、装置及系统
CN102148687B (zh) * 2011-05-09 2014-02-05 北京数码大方科技股份有限公司 信息管理系统中的签名方法及装置
CN102843387B (zh) * 2011-06-20 2017-02-01 北京太能沃可网络科技股份有限公司 一种基于安全分级的云计算安全控制平台
US8839349B2 (en) * 2011-10-18 2014-09-16 Mcafee, Inc. Integrating security policy and event management
CN103067338B (zh) * 2011-10-20 2017-04-19 上海贝尔股份有限公司 第三方应用的集中式安全管理方法和系统及相应通信系统
CN104463510A (zh) * 2014-12-31 2015-03-25 天津云之峰科技有限公司 一种财务管理系统
CN106506238A (zh) * 2015-08-24 2017-03-15 中兴通讯股份有限公司 一种网元管理方法及系统
CN108243059B (zh) * 2016-12-27 2020-05-15 大唐移动通信设备有限公司 一种网管集中管理方法和服务端
CN106878084B (zh) * 2017-02-28 2020-03-06 新华三技术有限公司 一种权限控制方法和装置
CN107995203A (zh) * 2017-12-08 2018-05-04 中盈优创资讯科技有限公司 网络设备安全管理系统、方法及计算机可读存储介质
US11200763B2 (en) * 2017-12-15 2021-12-14 Assa Abloy Ab Providing credential set when network connection is unavailable
CN113678421B (zh) * 2020-01-19 2023-06-09 Oppo广东移动通信有限公司 安全域的配置、发现和加入方法及装置、电子设备
CN120216798A (zh) * 2025-05-23 2025-06-27 苏州元脑智能科技有限公司 用户管理方法、电子设备、存储介质及产品

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5941947A (en) * 1995-08-18 1999-08-24 Microsoft Corporation System and method for controlling access to data entities in a computer network
US7143438B1 (en) * 1997-09-12 2006-11-28 Lucent Technologies Inc. Methods and apparatus for a computer network firewall with multiple domain support
US6070244A (en) * 1997-11-10 2000-05-30 The Chase Manhattan Bank Computer network security management system
US6158010A (en) * 1998-10-28 2000-12-05 Crosslogix, Inc. System and method for maintaining security in a distributed computer network
US6678835B1 (en) * 1999-06-10 2004-01-13 Alcatel State transition protocol for high availability units
US7693976B2 (en) * 2000-07-11 2010-04-06 Ciena Corporation Granular management of network resources
US7362868B2 (en) * 2000-10-20 2008-04-22 Eruces, Inc. Hidden link dynamic key manager for use in computer systems with database structure for storage of encrypted data and method for storage and retrieval of encrypted data
ATE323371T1 (de) * 2001-10-25 2006-04-15 Gen Dynamics Gov Sys Corp Verfahren und system zur modellierung, analyse und anzeige von netzsicherheitsereignissen
CN1313950C (zh) * 2001-11-29 2007-05-02 上海复旦光华信息科技股份有限公司 域用户集中授权管理系统及其方法
DE10206009A1 (de) * 2002-02-14 2003-08-28 Alcatel Sa Dienstleistungs-Server
US7149740B2 (en) * 2002-03-26 2006-12-12 Symmetricom, Inc. Using a common link field key
US7003527B1 (en) * 2002-06-27 2006-02-21 Emc Corporation Methods and apparatus for managing devices within storage area networks
GB0227049D0 (en) * 2002-11-20 2002-12-24 Bae Sys Defence Sys Ltd Management of network security domains
CN1309208C (zh) * 2003-05-23 2007-04-04 联想(北京)有限公司 一种计算机网络的网络安全系统及其控制方法
JP2004357234A (ja) * 2003-05-30 2004-12-16 Nippon Telegr & Teleph Corp <Ntt> セキュリティ管理装置、セキュリティ通信装置、ファイアウォール設定方法、ファイアウォール設定用プログラム、及びファイアウォール設定用記録媒体。
US20050081055A1 (en) * 2003-10-10 2005-04-14 Bea Systems, Inc. Dynamically configurable distributed security system

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
None

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101442425B (zh) * 2007-11-22 2012-03-21 华为技术有限公司 网关的管理方法及装置、系统
CN103634138A (zh) * 2012-08-27 2014-03-12 阿里巴巴集团控股有限公司 分布式调度的远程管理与运维方法及其系统
CN103634138B (zh) * 2012-08-27 2016-12-28 阿里巴巴集团控股有限公司 分布式调度的远程管理与运维方法及其系统
CN102932184A (zh) * 2012-11-06 2013-02-13 华为技术有限公司 一种网络管理的方法、装置及系统
WO2014100781A1 (en) 2012-12-23 2014-06-26 Mcafee, Inc. Trusted container
EP2936373A4 (de) * 2012-12-23 2016-07-27 Mcafee Inc Gesicherter behälter
US9419953B2 (en) 2012-12-23 2016-08-16 Mcafee, Inc. Trusted container
US10333926B2 (en) 2012-12-23 2019-06-25 Mcafee, Llc Trusted container
US10757094B2 (en) 2012-12-23 2020-08-25 Mcafee, Llc Trusted container
US9088543B2 (en) 2013-06-03 2015-07-21 International Business Machines Corporation Coordinated network security management

Also Published As

Publication number Publication date
CN100461690C (zh) 2009-02-11
CN1889452A (zh) 2007-01-03
CN101160775A (zh) 2008-04-09
EP1746764A3 (de) 2007-02-07
WO2007009350A1 (en) 2007-01-25
US20070022470A1 (en) 2007-01-25

Similar Documents

Publication Publication Date Title
EP1746764A2 (de) System, Vorrichtung und Verfahren zur vereinheitlichten Netzsicherheitsverwaltung
US11509645B2 (en) Device authentication based upon tunnel client network requests
US10791147B2 (en) Device authentication based upon tunnel client network requests
EP2345205B1 (de) Vorrichtung und verfahren zum aushandeln von verbindungen zwischen richtlinienquellenservern, firmenarchiven und mobilgeräten
CN100492991C (zh) 网元管理的方法、系统及网元
EP3876497B1 (de) Aktualisierte einhaltungsbewertung von endpunkten
US20110072502A1 (en) Method and Apparatus for Identity Verification
KR102533536B1 (ko) 사설 네트워크 간의 통신을 위한 방법， 장치， 전자 기기 및 저장 매체
CN101166173A (zh) 一种单点登录系统、装置及方法
US11765167B2 (en) System and method for secure onboarding of network devices
WO2014038820A1 (ko) 무선 통신 시스템에서 서버의 단말의 리소스에 대한 접근 권한을 관리하기 위한 방법 및 이를 위한 장치
CN101227470A (zh) 一种业务管理系统及业务管理方法
CN112104476B (zh) 一种广域网网络组网自动智能配置的方法和系统
KR20050122343A (ko) 네트워크 통합 관리 시스템
WO2010031234A1 (zh) 网元权限管理系统和方法
CN116723023A (zh) 一种基于ssh协议的内网穿透登录方法及系统
CN116962149A (zh) 网络故障的检测方法和装置、存储介质及电子设备
CN116916307A (zh) 家居设备认证接入方法、装置、设备及介质
CN113660283A (zh) 一种合法性认证方法以及装置
CN113647075A (zh) 设备激活方法、终端设备及计算机存储介质
Tu et al. Design and implementation of unified identity management system based on SAML
KR20050067887A (ko) 유무선 인터넷 서비스를 위한 통합 인증 처리 장치 및 그방법
CN101599831A (zh) 一种通信网络安全管理方法及系统

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

PUAL Search report despatched

Free format text: ORIGINAL CODE: 0009013

17P Request for examination filed

Effective date: 20060721

AK Designated contracting states

Kind code of ref document: A2

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU LV MC NL PL PT RO SE SI SK TR

AX Request for extension of the european patent

Extension state: AL BA HR MK YU

AK Designated contracting states

Kind code of ref document: A3

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU LV MC NL PL PT RO SE SI SK TR

AX Request for extension of the european patent

Extension state: AL BA HR MK YU

RIC1 Information provided on ipc code assigned before grant

Ipc: H04L 29/06 20060101ALI20070102BHEP

Ipc: H04L 12/24 20060101AFI20061026BHEP

17Q First examination report despatched

Effective date: 20070308

AKX Designation fees paid

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU LV MC NL PL PT RO SE SI SK TR

R17C First examination report despatched (corrected)

Effective date: 20070919

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE APPLICATION HAS BEEN REFUSED

18R Application refused

Effective date: 20100217